Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Dependendo das suas necessidades, talvez seja necessário projetar sua arquitetura para funcionar
em vários projetos ao usar o Cloud Asset Inventory. Os seguintes cenários
são os mais comuns:
Projetos de orquestrador: quando você quer que um único projeto
ative operações do Cloud Asset Inventory em outros projetos.
Exportar entre projetos: quando você quer exportar metadados de recursos de um projeto para outro.
Cada um desses cenários requer alguma configuração para garantir que as operações sejam concluídas
com sucesso.
Projetos do orquestrador
Quando você usa um projeto para acionar operações do Inventário de recursos do Cloud em recursos de
outro projeto, em determinados cenários, é necessário especificar que a conta de serviço padrão
do Inventário de recursos do Cloud no outro projeto seja usada para realizar a
operação. Esses cenários incluem:
Para definir qual conta de serviço usar, defina o projeto de faturamento como o ID do projeto que contém os recursos em que você está operando. Se o projeto de faturamento
não for especificado, o Inventário de recursos do Cloud vai usar a conta de serviço padrão do Inventário de recursos do Cloud
no projeto que está fazendo a chamada, que pode não ter as
permissões necessárias para concluir a operação.
Embora não seja obrigatório para todas as operações, é recomendável sempre
especificar um projeto de faturamento para minimizar a confusão.
gcloud
Para a CLI gcloud, adicione a flag --billing-project ao comando para especificar o ID do projeto que contém a conta de serviço correta:
--billing-project=BILLING_PROJECT_ID
Como alternativa, você pode definir o projeto de faturamento antes de executar comandos com
a CLI gcloud. Primeiro, verifique se o projeto de faturamento é diferente
do projeto principal:
gcloudconfiglist
Em seguida, se necessário, defina o projeto de faturamento:
BILLING_PROJECT_ID: um ID de projeto com a
API Cloud Asset Inventory ativada e uma conta de serviço com permissões para
gerenciar o tópico de destino do Pub/Sub, o bucket do Cloud Storage ou a
tabela do BigQuery.
REST
Para a API REST, adicione o cabeçalho X-Goog-User-Project para especificar o ID do projeto que contém a conta de serviço correta:
"X-Goog-User-Project: BILLING_PROJECT_ID"
Forneça os valores a seguir:
BILLING_PROJECT_ID: um ID de projeto com a
API Cloud Asset Inventory ativada e uma conta de serviço com permissões para
gerenciar o tópico de destino do Pub/Sub, o bucket do Cloud Storage ou a
tabela do BigQuery.
Exportar entre projetos
Para exportar metadados de um projeto, PROJECT_A, para outro, PROJECT_B,
conceda à conta de serviço padrão do Inventário de recursos do Cloud em PROJECT_A acesso aos
recursos em PROJECT_B.
Isso permite duas coisas:
É possível exportar metadados de recursos de PROJECT_A para um tópico do Pub/Sub,
um bucket do Cloud Storage ou uma tabela do BigQuery localizado em
PROJECT_B.
É possível usar PROJECT_A para exportar metadados de recursos de PROJECT_B para um
tópico do Pub/Sub, um bucket do Cloud Storage ou uma tabela do
BigQuery localizado em PROJECT_B.
Para exportar metadados de recursos de um projeto para outro, siga estas
instruções:
Verifique se a
API Cloud Asset Inventory está
ativada no projeto em que você quer executar a solicitação, PROJECT_A.
Faça pelo menos uma chamada para a API Cloud Asset Inventory em PROJECT_A para criar a
conta de serviço padrão do Cloud Asset Inventory. Você também pode criar
manualmente:
Para gravar em uma tabela do BigQuery, conceda os papéis de
Editor de dados do BigQuery
(roles/bigquery.dataEditor) e
Usuário do BigQuery
(roles/bigquery.user) à conta de serviço no projeto:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-18 UTC."],[[["\u003cp\u003eCloud Asset Inventory operations may require configuring a project as an orchestrator to trigger actions in other projects.\u003c/p\u003e\n"],["\u003cp\u003eWhen using an orchestrator project, you often need to designate a billing project to ensure the correct service account within another project is used for operations like exporting metadata or monitoring asset changes.\u003c/p\u003e\n"],["\u003cp\u003eExporting asset metadata between different projects requires granting the default Cloud Asset Inventory service account in the initiating project access to resources in the target project.\u003c/p\u003e\n"],["\u003cp\u003eTo use a different project's resources, like Pub/Sub topics, Cloud Storage buckets, or BigQuery tables, the initiating project's service account must be granted the necessary roles within the target project.\u003c/p\u003e\n"],["\u003cp\u003eTo specify a billing project when using gcloud you must add the \u003ccode\u003e--billing-project\u003c/code\u003e flag, and for the REST API, add the \u003ccode\u003eX-Goog-User-Project\u003c/code\u003e header to indicate the project ID that has the correct service account.\u003c/p\u003e\n"]]],[],null,["# Work across multiple projects\n\nDepending on your needs, you might need to design your architecture to work\nacross multiple projects when using Cloud Asset Inventory. The following scenarios\nare the most common:\n\n- [**Orchestrator projects**](#orchestrator): When you want a single project to\n trigger Cloud Asset Inventory operations in other projects.\n\n- [**Export across projects**](#export): When you want to export resource\n metadata from one project to another.\n\nEach of these scenarios requires some setup to ensure that operations complete\nsuccessfully.\n\nOrchestrator projects\n---------------------\n\nWhen you use a project to trigger Cloud Asset Inventory operations on resources in\nanother project, in certain scenarios you need to specify that the default\nCloud Asset Inventory service account in the other project be used to perform the\noperation. These scenarios include:\n\n- [Exporting asset metadata to BigQuery](/asset-inventory/docs/export-bigquery)\n\n- [Exporting asset metadata to Cloud Storage buckets](/asset-inventory/docs/export-cloud-storage)\n\n- [Monitoring asset changes with Pub/Sub](/asset-inventory/docs/monitor-asset-changes)\n\nTo set which service account to use, you set the *billing project* to the ID of\nthe project that contains the resources you're operating on. If the billing\nproject isn't specified, Cloud Asset Inventory uses the default Cloud Asset Inventory\nservice account in the project that's making the call, which might not have the\npermissions required to complete the operation.\n\nAlthough it isn't required for all operations, it can be good practice to always\nspecify a billing project to minimize confusion.\n\n### gcloud\n\nFor the gcloud CLI, add the `--billing-project` flag to your\ncommand to specify the project ID that contains the correct service account: \n\n --billing-project=\u003cvar translate=\"no\"\u003eBILLING_PROJECT_ID\u003c/var\u003e\n\nAlternatively, you can set the billing project before you run commands with\nthe gcloud CLI. First, check if the billing project is different\nfrom the core project: \n\n gcloud config list\n\nThen if you need to, set the billing project: \n\n gcloud config set billing/quota_project \u003cvar translate=\"no\"\u003eBILLING_PROJECT_ID\u003c/var\u003e\n\nProvide the following values:\n\n- \u003cvar translate=\"no\"\u003eBILLING_PROJECT_ID\u003c/var\u003e: A project ID that has the Cloud Asset Inventory API is enabled, and a service account with permissions to manage your target Pub/Sub topic, Cloud Storage bucket, or BigQuery table.\n\n### REST\n\nFor the REST API, add the `X-Goog-User-Project` header to specify the project\nID that contains the correct service account: \n\n \"X-Goog-User-Project: \u003cvar translate=\"no\"\u003eBILLING_PROJECT_ID\u003c/var\u003e\"\n\nProvide the following values:\n\n- \u003cvar translate=\"no\"\u003eBILLING_PROJECT_ID\u003c/var\u003e: A project ID that has the Cloud Asset Inventory API is enabled, and a service account with permissions to manage your target Pub/Sub topic, Cloud Storage bucket, or BigQuery table.\n\nExport across projects\n----------------------\n\nTo export asset metadata from one project, `PROJECT_A`, to another, `PROJECT_B`,\nyou must give the default Cloud Asset Inventory service account in `PROJECT_A` access to\nthe resources in `PROJECT_B`.\n\nThis enables two things:\n\n- You can export asset metadata from `PROJECT_A` into a Pub/Sub topic,\n Cloud Storage bucket, or BigQuery table located in\n `PROJECT_B`.\n\n- You can use `PROJECT_A` to export asset metadata from `PROJECT_B` into a\n Pub/Sub topic, Cloud Storage bucket, or BigQuery\n table located in `PROJECT_B`.\n\nTo export asset metadata from one project into another, complete the following\ninstructions:\n\n1. Make sure that the\n [Cloud Asset Inventory API](https://console.cloud.google.com/apis/library/cloudasset.googleapis.com) is\n enabled in the project you want to run your request from, `PROJECT_A`.\n\n2. Make at least one call to the Cloud Asset Inventory API in `PROJECT_A` to create the\n default Cloud Asset Inventory service account. Alternatively, you can create it\n manually:\n\n gcloud beta services identity create \\\n --service=cloudasset.googleapis.com \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_A_ID\u003c/var\u003e\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_A_ID\u003c/var\u003e \\\n --member=serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_A_NUMBER\u003c/var\u003e@gcp-sa-cloudasset.iam.gserviceaccount.com \\\n --role=roles/cloudasset.serviceAgent\n\n\n How to find a Google Cloud project number\n\n ### Google Cloud console\n\n To find a Google Cloud project number, complete the following steps:\n 1. Go to the **Welcome** page in the Google Cloud console.\n\n\n [Go to Welcome](https://console.cloud.google.com/welcome)\n 2. Click the **switcher** list box in the menu bar.\n 3.\n Select your organization from the list box, and then search for your project name.\n The project name, project number, and project ID are shown near the **Welcome**\n heading.\n\n\n Up to 4,000 resources are displayed. If you don't see the project you're looking for,\n go to the\n [**Manage resources**](https://console.cloud.google.com//cloud-resource-manager) page and\n filter the list using the name of that project.\n\n ### gcloud CLI\n\n You can retrieve a Google Cloud project number with the following command: \n\n ```bash\n gcloud projects describe PROJECT_ID --format=\"value(projectNumber)\"\n ```\n\n \u003cbr /\u003e\n\n3. Grant the correct roles to the service account in `PROJECT_A`.\n\n - To publish to a feed through Pub/Sub, grant the\n [Pub/Sub Publisher role](/iam/docs/understanding-roles#pubsub.publisher)\n (`roles/pubsub.publisher`) role to the service account on the topic:\n\n gcloud pubsub topics add-iam-policy-binding projects/\u003cvar translate=\"no\"\u003ePROJECT_B_ID\u003c/var\u003e/topics/\u003cvar translate=\"no\"\u003eTOPIC_ID\u003c/var\u003e \\\n --member=serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_A_NUMBER\u003c/var\u003e@gcp-sa-cloudasset.iam.gserviceaccount.com \\\n --role=roles/pubsub.publisher\n\n - To write to a Cloud Storage bucket, grant the\n [Storage admin](/iam/docs/understanding-roles#storage.admin)\n (`roles/storage.admin`) role to the service account on the bucket:\n\n gcloud storage buckets add-iam-policy-binding gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e \\\n --member=serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_A_NUMBER\u003c/var\u003e@gcp-sa-cloudasset.iam.gserviceaccount.com \\\n --role=roles/storage.admin\n\n - To write to a BigQuery table, grant the\n [BigQuery Data Editor](/iam/docs/understanding-roles#bigquery.dataEditor)\n (`roles/bigquery.dataEditor`) and\n [BigQuery user](/iam/docs/understanding-roles#bigquery.user)\n (`roles/bigquery.user`) roles to the service account on the project:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_B_ID\u003c/var\u003e \\\n --member=serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_A_NUMBER\u003c/var\u003e@gcp-sa-cloudasset.iam.gserviceaccount.com \\\n --role=roles/bigquery.dataEditor\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_B_ID\u003c/var\u003e \\\n --member=serviceAccount:service-\u003cvar translate=\"no\"\u003ePROJECT_A_NUMBER\u003c/var\u003e@gcp-sa-cloudasset.iam.gserviceaccount.com \\\n --role=roles/bigquery.user\n\nIf you make a Cloud Asset Inventory request with the gcloud CLI from\n`PROJECT_B` or use the REST API, make sure to\n[specify `PROJECT_A` as the billing project](#billing-project)."]]
